{"action":"Upgrade github.com/cometbft/cometbft to 0.37.11 or later.","affected":[{"fixed":"0.37.11","introduced":"0.37.0"},{"fixed":"0.38.12","introduced":"0.38.0"}],"component":"github.com/cometbft/cometbft","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["0.37.11","0.38.12"],"ghsa_id":"GHSA-g5xx-c4hv-9ccc","id":"tcs_01M5KFAC6QXEV7KRE79XKQ445J","modified_at":"2024-11-18T16:27:09Z","published_at":"2024-09-03T20:03:08Z","references":["https://osv.dev/vulnerability/GHSA-g5xx-c4hv-9ccc","https://github.com/cometbft/cometbft/security/advisories/GHSA-g5xx-c4hv-9ccc","https://github.com/cometbft/cometbft/commit/3937e00a339ee6b861d75997b4f6c87d867b74f2","https://github.com/cometbft/cometbft/commit/52c00a537f8f56ed94b4a5c8af6e3fecff468b55","https://github.com/cometbft/cometbft","https://pkg.go.dev/vuln/GO-2024-3112"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-g5xx-c4hv-9ccc#Go/github.com/cometbft/cometbft","url":"https://osv.dev/vulnerability/GHSA-g5xx-c4hv-9ccc"}],"summary":"CometBFT's state syncing validator from malicious node may lead to a chain split"}